Download PDFOpen PDF in browserLLM-assisted Generation of Pseudo-C2 Servers for IoT Malware Dynamic Analysis16 pages•Published: August 6, 2026AbstractMost IoT malware operates as botnets dependent on Command and Control (C2) servers, but the short-lived nature of attack infrastructure often leaves samples dormant without C2 communication, hindering dynamic analysis. This paper proposes a system that combines Ghidra with a Large Language Model (LLM) to extract communication specifications from a malware binary and automatically generate a pseudo-C2 server. Experiments using Mirai demonstrate that the proposed system semantically interprets binary control structures and extracts all 20 core protocol elements in agreement with the ground truth (100% specification extraction accuracy). The generated pseudo-C2 server reproduces seven of ten DDoS attack vectors with full fidelity, generating traffic volumes of 82.9%—126.6% (averaging 100.1%) of the original C2. When applied to a customized variant created by modifying the publicly available Mirai source code, the method succeeds end-to-end — from specification extraction through pseudo-C2 generation to attack reproduction — demonstrating that the LLM infers specifications from binary structures without relying on pre-trained knowledge. This approach extends the applicability of LLMs from analysis assistance to the automated construction of dynamic analysis environments.Keyphrases: automatic generation, iot malware, large language model, mirai, pseudo c2 server, static analysis In: Tung-Tso Tsai, Huy Kang Kim, Yujue Wang and Akira Yamada (editors). Proceedings of The 21st Asia Joint Conference on Information Security, vol 111, pages 1-16.
|
